LAPS

Implement Microsoft Local Administrator Solution A common practice when running Windows networks is to set the local Administrator account to the same password on every machine. Whilst this makes system administration more convenient the practice also makes is easier for attackers. When an attacker has compromised one machine, they are able to obtain the administrator password and then use the password to access any other machine on the same network. 
The "Local Administrator Password Solution" (LAPS) provides management of local account passwords of domain joined computers. Passwords are stored in Active Directory (AD) and protected by ACL, so only eligible users can read it or request its reset. 
LAPS removes the common local account password by setting a random password on each machine. LAPS also mitigates the risk of a Pass-the-Hash (PtH) credential replay attacks. 

Consider implementing Microsoft LAPS. 
https://www.microsoft.com/en-us/download/details.aspx?id.46899

Email Security

SPF (Sender Policy Framework) is a standard that helps reduce spam. Each domain lists in one DNS record a list of all the servers that are allowed to send emails for that domain. When an email provider like Gmail sees an email sent from an address @example.com but coming from a server not listed in the SPF record, it knows it is likely to be spam. 

Conversely, it is important to set such a record to avoid your emails to be considered spam. More and more email providers consider domains without SPF record as more suspicious than others. Even if your domain does not send emails, you should set a SPF record as this will prevent spammers from faking emails from your domain. 

Implement DKIM and DMARC to strengthen email security. Deploying both configuration with SPF hard fail will prevent any third party sending emails pretending to be from @companydomain. This will prevent spear phishing emails internally and externally to customers and suppliers. 

Email Archiving

Lack of Email Archiving Email archiving is the act of preserving and making searchable all email to/from an individual. Archiving emails is considered a better practice as it allows an organisation to control the size of mailboxes and to keep a non-reputable copy in case of legal disputes. 

Implement some form of email journaling or archival to meet compliance or admissible evidence in court proceedings. Check if Barracuda offer additional archiving services or purchase additional software and storage for on-premise vault. Alternatively, Office 365 business plans have large mailbox and storage capacities, and offers legal hold as additional add-on service.

Patching

Hackers take advantage of errors in software code to attack and take over computers. These vulnerabilities are specifically targeted by attackers. Software vendors correct errors in their code by releasing patches. Applying patches is one of the most effective measures to improve the security of a computer system. 

Patching implement Windows Update Server Services to manage, monitor and control the deployment of Windows patches. This free Windows application. 

Administrator Privileges

Administrator or admin access is a level of access where the user has full, complete or unrestricted access to the entire system and all its data. Users with administrative access pi privileges for operating systems and applications can make significant changes to their configuration and operation, bypass critical security settings and access sensitive ' information.

Make sure Users do not have Local Admin to Machines and Administers have a specific login for Domain Admin Tasks for Logging and Auditing

Logging

Consider implementing a system for managing and storing logs from key infrastructure services are periodically copied to an external system for long term storage and access.

We recommend that at least the last 3 months logging information is on hand for immediate analysis and that at least the last 12 months of logging data can be retrieved when required for analysis.

Limited Retention of Logs Logging should be enabled across all systems and logs retained for a reasonable period to allow investigation and review of events that have occurred in the past.

 The lack of available logging information makes any subsequent investigation into an incident that occurred in the past very difficult to perform.

Network segmentation

Network segmentation is the act of splitting a network into many "sub networks" or areas. Segmentation segregates and protects company data and systems and limits attackers' lateral movements between computers and across the network.

There should be an segmentation between internal network and internet accessible computers. Should an internet facing computer be compromised by attackers the rest of the company network will be easily accessible.

Consider implementing network segmentation. At a minimum, internet facing systems should be segregated from the internal network by creating a demilitarised zone or DMZ.

Network access to administer computers, firewalls, switches and routers is not restricted. Any computer on the network can connect to any other computer on the network and potentially access services that are only meant to be accessed by IT administrators.

Access to administration ports should be restricted to only certain network addresses and/or computer systems.

This can be achieved through network segmentation and/or by implementing IP address restrictions for accessing administration functions such as SSH, remote desktop or web based administration portals.